AgentBBS: M0 core hub, M1 arcade, pods with CoinPay membership

A modern BBS over SSH for humans and AI agents (docs/PRD.md), plus the
pods addendum (docs/pods.md). Go + charmbracelet (wish/bubbletea).

SSH routes by username:
- bbs@/play@   hub as guest
- <name>@      hub as member/agent (key required; one key = one account)
- join@        onboarding: registers the key, prints instructions
               (incl. coinpay pay command with HMAC payment ref), kicks
- pod@         personal Linux container, paid membership $1/mo via
               CoinPay; rootless podman preferred, hardened docker
               fallback (cap-drop ALL, no-new-privileges, uid 1000,
               cpu/mem/pids caps, per-user volume)

M0: plugin contract (ID/Title/Description/RequiresAuth/New + ExitMsg),
hub menu, SQLite store (users/sessions/scores/pod_subscriptions),
session audit, grant-pod ops command.

M1 arcade: doom-ascii + Freedoom via scripts/fetch-assets.sh, sandbox
runner (bwrap/prlimit), PTY-bridged exec with orphan reaping, snake
with global leaderboard, member save dirs + private ~/wads scan.

Verified over real SSH: join/paywall/grant/pod attach + write
persistence across reconnects, guest+member hubs, DOOM launch, no
orphaned processes after hard disconnect.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/pods/pods.go

@@ -0,0 +1,170 @@
+// Package pods gives paid members a personal Linux container over SSH
+// (`ssh pod@host`) — "run shit in a docker-like" without root on the host.
+//
+// Engine preference: rootless Podman (daemonless; container root maps to an
+// unprivileged host uid via user namespaces), falling back to Docker with a
+// hardened profile (cap-drop ALL, no-new-privileges, non-root user, cpu/mem/
+// pids caps). Either way the SSH user never touches the host OS.
+package pods
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+	"sync"
+
+	"github.com/charmbracelet/ssh"
+	"github.com/creack/pty"
+)
+
+// Manager provisions and attaches per-user pods.
+type Manager struct {
+	engine string // "podman" or "docker"
+	image  string
+
+	mu       sync.Mutex
+	attached map[string]int // container name -> live session count
+}
+
+// Detect picks the best available engine. Returns an error if neither
+// podman nor docker is present.
+func Detect() (*Manager, error) {
+	image := os.Getenv("AGENTBBS_POD_IMAGE")
+	if image == "" {
+		image = "debian:stable-slim"
+	}
+	for _, eng := range []string{"podman", "docker"} {
+		if _, err := exec.LookPath(eng); err == nil {
+			return &Manager{engine: eng, image: image, attached: map[string]int{}}, nil
+		}
+	}
+	return nil, fmt.Errorf("pods: neither podman nor docker found")
+}
+
+// Engine reports the active container engine.
+func (m *Manager) Engine() string { return m.engine }
+
+var unsafeName = regexp.MustCompile(`[^a-zA-Z0-9_.-]`)
+
+func (m *Manager) containerName(user string) string {
+	return "agentbbs-pod-" + unsafeName.ReplaceAllString(strings.ToLower(user), "-")
+}
+
+// ensure creates (or starts) the user's container and returns its name.
+func (m *Manager) ensure(user string) (string, error) {
+	name := m.containerName(user)
+	if m.engine == "docker" {
+		// Under docker the pod runs as uid 1000 (never container root), so
+		// the named home volume must be owned by 1000. A trusted one-shot
+		// init container enforces that on every ensure — volumes can predate
+		// the container or survive recreation. Rootless podman doesn't need
+		// this: container root maps to the unprivileged host user.
+		init := exec.Command(m.engine, "run", "--rm",
+			"-v", name+"-home:/home/dev", m.image,
+			"sh", "-c", "chown 1000:1000 /home/dev")
+		if out, err := init.CombinedOutput(); err != nil {
+			return "", fmt.Errorf("pods: volume init failed: %v: %s", err, strings.TrimSpace(string(out)))
+		}
+	}
+	// Already exists?
+	if err := exec.Command(m.engine, "container", "inspect", name).Run(); err == nil {
+		_ = exec.Command(m.engine, "start", name).Run() // no-op if running
+		return name, nil
+	}
+	args := []string{
+		"run", "-d",
+		"--name", name,
+		"--hostname", "pod-" + unsafeName.ReplaceAllString(user, "-"),
+		"--memory", env("AGENTBBS_POD_MEM", "512m"),
+		"--cpus", env("AGENTBBS_POD_CPUS", "1"),
+		"--pids-limit", "256",
+		"--cap-drop", "ALL",
+		"--security-opt", "no-new-privileges",
+		"--restart", "unless-stopped",
+		"-v", name + "-home:/home/dev",
+		"-w", "/home/dev",
+		"-e", "HOME=/home/dev",
+	}
+	if m.engine == "docker" {
+		// Rootless podman user-ns maps container root safely; under docker,
+		// refuse to hand out container root at all.
+		args = append(args, "--user", "1000:1000")
+	}
+	args = append(args, m.image, "sleep", "infinity")
+	out, err := exec.Command(m.engine, args...).CombinedOutput()
+	if err != nil {
+		return "", fmt.Errorf("pods: create failed: %v: %s", err, strings.TrimSpace(string(out)))
+	}
+	return name, nil
+}
+
+// Attach provisions the pod and wires the SSH session to a shell inside it.
+// Blocks until the shell exits or the session closes.
+func (m *Manager) Attach(s ssh.Session, user string) error {
+	ptyReq, winCh, hasPty := s.Pty()
+	if !hasPty {
+		return fmt.Errorf("pods: a PTY is required (ssh -t)")
+	}
+	name, err := m.ensure(user)
+	if err != nil {
+		return err
+	}
+
+	shell := env("AGENTBBS_POD_SHELL", "/bin/bash")
+	cmd := exec.Command(m.engine, "exec", "-it",
+		"-e", "TERM="+ptyReq.Term,
+		name, shell, "-l")
+	f, err := pty.Start(cmd)
+	if err != nil {
+		// busybox-ish images may lack bash
+		cmd = exec.Command(m.engine, "exec", "-it", "-e", "TERM="+ptyReq.Term, name, "/bin/sh", "-l")
+		f, err = pty.Start(cmd)
+		if err != nil {
+			return fmt.Errorf("pods: attach failed: %w", err)
+		}
+	}
+	defer f.Close()
+
+	m.ref(name, +1)
+	defer m.deref(name)
+
+	_ = pty.Setsize(f, &pty.Winsize{Rows: uint16(ptyReq.Window.Height), Cols: uint16(ptyReq.Window.Width)})
+	go func() {
+		for w := range winCh {
+			_ = pty.Setsize(f, &pty.Winsize{Rows: uint16(w.Height), Cols: uint16(w.Width)})
+		}
+	}()
+
+	go func() { _, _ = io.Copy(f, s) }() // ssh -> pod
+	_, _ = io.Copy(s, f)                 // pod -> ssh
+	_ = cmd.Wait()
+	return nil
+}
+
+func (m *Manager) ref(name string, d int) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.attached[name] += d
+}
+
+// deref stops the container shortly after the last session detaches, unless
+// AGENTBBS_POD_KEEP=1 keeps pods running between visits.
+func (m *Manager) deref(name string) {
+	m.mu.Lock()
+	m.attached[name]--
+	last := m.attached[name] <= 0
+	m.mu.Unlock()
+	if last && os.Getenv("AGENTBBS_POD_KEEP") != "1" {
+		go func() { _ = exec.Command(m.engine, "stop", "-t", "2", name).Run() }()
+	}
+}
+
+func env(k, def string) string {
+	if v := os.Getenv(k); v != "" {
+		return v
+	}
+	return def
+}